Desktop: clicking a pooled remote profile no longer storms reconnects while the VPS backend cold-starts (#107997, salvage #108009 #97914)

[teknium1]

Clicking a pooled remote (SSH/VPS) profile no longer fails its dispatch probe against a backend that is merely cold-starting, so the probe→retire→reconnect→cold-start storm that pinned single-vCPU VPS boxes at 100% CPU stops.

Changes

• apps/desktop/electron/remote-liveness.ts
  • POOLED_REMOTE_DISPATCH_PROBE_TIMEOUT_MS reuses REMOTE_LIVENESS_TIMEOUT_MS (10s) instead of a hardcoded 2.5s, so a quiet-box hermes serve cold start (~6–8s) can finish before dispatch declares the tunnel dead. (cherry-picked from fix(desktop): give pooled remote dispatch probes the cold-start liveness budget #108009, @KoNit-K)
  • The dispatch probe hits /api/health instead of /api/status. /api/status (hermes_cli/web_routers/status.py::get_status) awaits a gateway health probe, topology collection, a state.db active-session count, a threadpool config load and component health — seconds on a cold forward; /api/health returns {ok, version, auth_required} with zero I/O. (cherry-picked from fix(desktop): probe /api/health on pooled SSH dispatch, not /api/status #97914, @bennybuoy)
  • On an explicit 404 (backend older than 0.19, before /api/health existed) the probe falls back to /api/status exactly like the boot readiness probe in backend-health.ts already does, so old remotes are not put back into the reconnect storm. (fallback idea + test from fix(desktop): stop SSH dispatch probe killing healthy tunnels #101976, @edosulai)
• apps/desktop/electron/remote-liveness.test.ts: three invariants — dispatch budget covers cold start and stays below the power-resume holdoff; a healthy descriptor is returned without retire/reconnect; a 404 on /api/health falls back to /api/status without retiring.

Root cause: the dispatch probe budget (2.5s) was a quarter of the background liveness budget and shorter than the backend's own startup time, and it probed the heaviest public endpoint, so a healthy-but-booting backend was indistinguishable from a dead tunnel.

Validation

Check	Result
npx vitest run --project electron electron/remote-liveness.test.ts	25 passed
Same file with fix neutralized (timeout back to 2_500, fallback disabled)	2 failed (the new invariants), 23 passed
electron/backend-health.test.ts + electron/ssh-connection.test.ts (siblings)	94 passed
npx tsc -p tsconfig.electron.json --noEmit / npx tsc -p . --noEmit	clean
npx eslint on touched files, git diff --check	clean
Live desktop repro against a VPS	not run (no multi-profile Electron + remote host here)

Fixes #107997
Supersedes #108009 (cherry-picked, authorship preserved)
Supersedes #97914 (cherry-picked, authorship preserved; timeout raised from its 5s to the 10s liveness budget — 5s does not cover the measured 6–8s cold start)
Supersedes #108016 (same one-line timeout change as #108009, opened 12 minutes later without tests — not absorbed, superseded by #108009's commit)
Partially absorbs #101976 (legacy /api/status fallback + its test, co-author credit). Not adopted from it: the per-descriptor "tolerate one timeout" streak (WeakMap + message-sniffing isDispatchProbeTimeoutError; with a 10s health probe a timeout is no longer ambiguous, and tolerating it returns a possibly-dead descriptor to a synchronous click) and ServerAliveInterval/CountMax on the SSH ControlMaster (a separate keepalive question, not this bug).

Not changed: the pool fan-out where one profile click wakes every pooled profile (second half of #107997) — separate seam (main.ts / pool-*.ts), out of this PR's scope.

Infographic

[alt-glitch]

This was generated by AI during triage.

Supersedes #108009 and #108016 (same #107997 fix, cherry-picked here with authorship preserved) and folds in the /api/health probe from #97914. Those PRs can likely be closed once this lands.

[github-actions]

૮ >ﻌ< ა ci review

_{ran on 7ba1635 — fix(desktop): dispatch probe falls back to /api/status on pr}

⚠️ Warnings

CI timings · View report · View job

Wall time 50m19s vs 5m21s (+840.5%). 5 job(s) slower, 3 faster,

• JS & TS checks / JS & TS checks: +6.0s
• OSV scan / Scan lockfiles / osv-scan: +5.0s
• OSV scan / Emit review status: +4.0s
• Profile artifact check / Reject profile archives: -2.0s
• Detect affected areas: +2.0s

---

OSV vulnerability scan · View job

80 known vulnerabilities found in pinned dependencies.

• CVE-2026-83608 in package-lock.json
• CVE-2026-83608 in package-lock.json
• CVE-2026-84375 in package-lock.json
• CVE-2026-84375 in website/package-lock.json
• CVE-2026-67213 in website/package-lock.json
• CVE-2026-85062 in package-lock.json
• CVE-2026-85062 in website/package-lock.json
• CVE-2026-83609 in package-lock.json
• CVE-2026-82417 in scripts/whatsapp-bridge/package-lock.json
• CVE-2026-82417 in website/package-lock.json
• CVE-2026-84369 in website/package-lock.json
• CVE-2026-83605 in package-lock.json
• CVE-2026-83605 in package-lock.json
• CVE-2026-75931 in package-lock.json
• CVE-2026-75931 in website/package-lock.json
• CVE-2026-83610 in package-lock.json
• CVE-2026-83610 in package-lock.json
• CVE-2026-83611 in package-lock.json
• CVE-2026-83611 in package-lock.json
• CVE-2026-71554 in uv.lock

How to fix:

Review the findings in the Security tab. Update the affected dependencies if a patched version is available.